Overview

overview

10

Static

static

SecuriteIn...03.exe

windows7-x64

10

SecuriteIn...03.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe
  • Size 495KB
  • Sample220930-fp9xcaceh2
  • SHA256 5d35bb95e95e3e166b00362d93f852af93448a4039894bbe25a55e79b29084d8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookermrratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • ermr

Decoy

  • ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=

  • qNSdDhu/PT/1fgafDagiCSZH1SY=

  • wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=

  • jSxRvptHkeTGl7PT0SEmaZmjqzanuA==

  • b91oL+2wCcpyhnd6yvF6Pg==

  • mr81yp1/qqZX

  • hy7Xsz/PU/LWHMcGL4UYJx9n3A==

  • KlwrHt1gouPaXaWhoQ==

  • ng8M320IRJL9Ptw=

  • 8GQbOXuaWxvKnNM=

  • XndOL7E5sNpVUNty4d/a

  • rryPBBC8PybYb+2h2MF3FHGL

  • kEoeyERSVCYO0g==

  • 5/P+SBDby5hO

  • 1fYXc30/h9W7iO17

  • 34X+YKR+wRFE

  • 8ir/X2MlVByh5lQ1ow8=

  • u9ikm2UMZ7J7hpCYow==

  • FLI+c3clp1BNDjVAfvC2Dnw=

  • t21Erq8/r09wAzAJTAH3Ng==

Targets

    • Target
      SecuriteInfo.com.Trojan.Mardom.MN.24.20742.7603.exe
    • Size 495KB
    • SHA256 5d35bb95e95e3e166b00362d93f852af93448a4039894bbe25a55e79b29084d8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookermrratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks